Term

Definition

Security operations center (SOC)

The location where security professionals monitor and protect critical information assets in an organization.

Development and operations (DevOps)

A combination of software development and systems operations and refers to the practice of integrating one discipline with the other.

DevSecOps

A combination of software development, security operations, and systems operations and refers to the practice of integrating each discipline with the others.

Computer incident response team (CIRT)/computer security incident response team (CSIRT)/computer emergency response team (CERT)

Team with responsibility for incident response. The CSIRT must have expertise across a number of business domains (IT, HR, legal, and marketing, for instance).

Exam

Objective

CompTIA Security+ SY0-701

1.1 Compare and contrast various types of security controls.

• Categories

o   Technical

o   Managerial

o   Operational

o   Physical

1.2 Summarize fundamental security concepts.

• Confidentiality, Integrity, and Availability (CIA)

2.1 Compare and contrast common threat actors and motivations.

• Threat actors

o   Nation-state

o   Organized crime

Video/Demo

Time

    1.1.1 The Security Landscape

3:47

    1.1.2 Security Concepts

4:12

    1.1.4 Security Job Roles

5:00

Total Video Time

12:59

Term

Definition

Security control

A technology or procedure put in place to mitigate vulnerabilities and risk and to ensure the confidentiality, integrity, and availability (CIA) of information.

Managerial

A category of security control that provides oversight of information systems.

Operational

A category of security control that is implemented by people.

Technical

A category of security control that is implemented as a system.

Physical

A category of security control that is implemented by hardware used to deter or detect, such as as alarms, gateways, locks, lighting, and security cameras.

Preventive

A type of security control that acts before an incident to eliminate or reduce the likelihood that an attack can succeed.

Access control lists (ACLs)

The collection of access control entries (ACEs) that determines which subjects (user accounts, host IP addresses, and so on) are allowed or denied access to the object and the privileges given (read-only, read/write, and so on).

Detective

A type of security control that acts during an incident to identify or record that it is happening.

Corrective

A type of security control that acts after an incident to eliminate or minimize its impact.

Directive

A type of control that enforces a rule of behavior through a policy or contract.

Deterrent

A type of security control that discourages intrusion attempts.

Compensating

A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.

Chief Information Officer (CIO)

A company officer with the primary responsibility of managing information technology assets and procedures.

Chief Technology Officer (CTO)

A company officer with the primary role of making effective use of new and emerging computing platforms and innovations.

Chief Security Officer (CSO)

Typically, the job title of the person with overall responsibility for information assurance and systems security.

Information Systems Security Officer (ISSO)

Organizational role with technical responsibilities for implementation of security policies, frameworks, and controls.

Exam

Objective

CompTIA Security+ SY0-701

1.1 Compare and contrast various types of security controls.

• Categories

o   Technical

o   Managerial

o   Operational

o   Physical

• Control types

o   Preventive

o   Deterrent

o   Detective

o   Corrective

o   Compensating

o   Directive

Video/Demo

Time

    1.2.1 Control Categories and Types

4:18

Total Video Time

4:18

Term

Definition

Lab simulator

The lab simulator is a LabSim learning tool that presents a virtual environment that you can manipulate like an actual environment.

Lab tasks

The tasks necessary to complete the lab.

Navigation bar

A lab simulation feature used to change to a new location, such as a building, floor, or office.

Shelf

An area that contains hardware components that may be used in the simulation.

Exhibits

Additional information about the simulation environment that may be useful in completing the lab.

Video/Demo

Time

    1.3.1 Use the Simulator

12:08

    1.3.2 Labsim Features

10:14

Total Video Time

22:22

Term

Definition

Threat actor

A person or entity responsible for an event that has been identified as a security incident or as a risk.

Internal/external

The degree of access that a threat actor possesses before initiating an attack. An external threat actor has no standing privileges, while an internal actor has been granted some access permissions.

Level of sophistication/capability

A formal classification of the resources and expertise available to a threat actor.

Resources/funding

The ability of threat actors to draw upon funding to acquire personnel, tools, and development of novel attack types.

Service disruption

A type of attack that compromises the availability of an asset or business process.

Data exfiltration

The process by which an attacker copies data from a private network to an external network.

Disinformation

A type of attack that falsifies an information resource that is normally trusted by others.

Blackmail

Demanding payment to prevent the release of information.

Extortion

Demanding payment to prevent or halt some type of attack.

Fraud

Falsifying records, such as an internal fraud that involves tampering with accounts.

Hacker

Often used to refer to someone who breaks into computer systems or spreads viruses. Ethical hackers prefer to think of themselves as experts on and explorers of computer security systems.

Unauthorized hacker

A hacker operating with malicious intent.

Authorized hacker

A hacker engaged in authorized penetration testing or other security consultancy.

Unskilled attacker

An inexperienced attacker that typically uses tools or scripts created by others.

Hacktivist

A threat actor that is motivated by a social issue or political cause.

Advanced persistent threat (APT)

An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.

Nation-state actors

A type of threat actor that is supported by the resources of its host country's military and security services.

Organized crime

A type of threat actor that uses hacking and computer fraud for commercial gain.

Internal threat

A type of threat actor who is assigned privileges on the system that cause an intentional or unintentional incident.

Unintentional or inadvertent insider threat

A threat actor that causes a vulnerability or exposes an attack vector without malicious intent.

Shadow IT

Computer hardware, software, or services used on a private network without authorization from the system owner.

Vulnerable software

Weakness that could be triggered accidentally or exploited intentionally to cause a security breach.

Unsupported systems

Product life cycle phase where mainstream vendor support is no longer available.

Unsecure network

Configuration that exposes a large attack surface, such as through unnecessary open service ports, weak or no authentication, use of default credentials, or lack of secure communications/encryption.

Lure

An attack type that will entice a victim into using or opening a removable device, document, image, or program that conceals malware.

Supply chain

The end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer.

Exam

Objective

CompTIA Security+ SY0-701

2.1 Compare and contrast common threat actors and motivations.

• Threat actors

o   Nation-state

o   Unskilled attacker

o   Hacktivist

o   Insider threat

o   Organized crime

o   Shadow IT

• Attributes of actors

o   Internal/external

o   Resources/funding

o   Level of sophistication/capability

• Motivations

o   Data exfiltration

o   Espionage

o   Service disruption

o   Blackmail

o   Financial gain

o   Philosophical/political beliefs

o   Ethical

o   Revenge

o   Disruption/chaos

o   War

2.2 Explain common threat vectors and attack surfaces.

• Message-based

o   Email

o   Short Message Service (SMS)

o   Instant messaging (IM)

• Image-based

o   File-based

o   Removable device

o   Vulnerable software

§  Client-based vs. agentless

o   Unsupported systems and applications

o   Unsecure networks

§  Wireless

§  Wired

§  Bluetooth

o   Open service ports

o   Default credentials

o   Supply chain

§  Managed service providers (MSPs)

§  Vendors

§  Suppliers

2.3 Explain various types of vulnerabilities.

• Supply chain

o   Service provider

o   Hardware provider

o   Software provider

2.4 Given a scenario, analyze indicators of malicious activity.

• Application attacks

o   Privilege escalation

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

• Least privilege

Video/Demo

Time

    2.1.1 Threat Actor Types

6:58

    2.1.2 Threat Actor Types Facts

6:20

    2.1.3 General Attack Strategy

6:03

    2.1.4 General Defense Strategy

7:47

    2.1.6 Attack Surfaces

8:18

Total Video Time

35:26

Term

Definition

Social engineering

An activity where the goal is to use deception and trickery to convince unsuspecting users to provide sensitive data or to violate security guidelines.

Impersonation

A social engineering attack where an attacker pretends to be someone they are not.

Pretexting

A social engineering tactic where a team communicates, whether directly or indirectly, a lie or half-truth in order to get someone to believe a falsehood.

Phishing

An email-based social engineering attack in which the attacker sends email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim.

Vishing

A human-based attack where the attacker extracts information while speaking over the phone or leveraging IP-based voice messaging services (VoIP).

Smishing

A form of phishing that uses SMS text messages to trick a victim into revealing information.

Pharming

A type of attack that redirects users from a legitimate website to a malicious one.

Typosquatting

An attack in which an attacker registers a domain name with a common misspelling of an existing domain, so that a user who misspells a URL in a browser is taken to the attacker's website.

Business email compromise

An impersonation attack in which the attacker gains control of an employee's account and uses it to convince other employees to perform fraudulent actions.

Watering hole attack

An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

Exam

Objective

CompTIA Security+ SY0-701

2.1 Compare and contrast common threat actors and motivations.

• Threat actors

o   Unskilled attacker

o   Insider threat

• Motivations

2.2 Explain common threat vectors and attack surfaces.

• Human vectors/social engineering

o   Phishing

o   Smishing

o   Vishing

o   Misinformation/disinformation

o   Impersonation

o   Business email compromise (BEC)

o   Pretexting

o   Watering hole

o   Brand impersonation

o   Typosquatting

5.6 Given a scenario, implement security awareness practices.

• User guidance and training

o   Social engineering

• Development

TestOut Security Pro

5.0 Audit and Security Assessment

    5.2 Assessment Techniques

5.2.2 Identify Social Engineering

Video/Demo

Time

    2.2.1 Social Engineering Overview

4:20

    2.2.3 Social Engineering Techniques

5:43

    2.2.5 Use the Social Engineer Toolkit

4:21

    2.2.6 Investigating a Social Engineering Attack

6:26

Total Video Time

20:50

Term

Definition

Malware

Software that serves a malicious purpose, typically installed without the user's consent (or knowledge).

Trojan

A malicious software program hidden within an innocuous-seeming piece of software. Usually, the Trojan is used to try to compromise the security of the target computer.

Potentially unwanted programs (PUPs)/potentially unwanted applications (PUAs)

Software that cannot definitively be classed as malicious, but may not have been chosen or wanted by the user.

Virus

Malicious code inserted into an executable file image. The malicious code is executed when the file is run and can deliver a payload, such as attempting to infect other files.

Malicious process

A process executed without proper authorization from the system owner for the purpose of damaging or compromising the system.

Worm

A type of malware that replicates between processes in system memory and can spread over client/server network connections.

Shellcode

A lightweight block of malicious code that exploits a software vulnerability to gain initial access to a victim system.

Advanced persistent threat (APT)

An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.

Adware

Software that records information about a PC and its user. Adware is used to describe software that the user has acknowledged can record information about their habits.

Spyware

Software that records information about a PC and its users, often installed without the user's consent.

Keylogger

Malicious software or hardware that can record user keystrokes.

Backdoor

A mechanism for gaining access to a computer that bypasses or subverts the normal method of authentication.

Remote access Trojan (RAT)

Malware that creates a backdoor remote administration channel to allow a threat actor to access and control the infected host.

Botnet

A group of hosts or devices that has been infected by a control program called a bot, which enables attackers to exploit the hosts to mount attacks.

Command and control (C2 or C&C)

Infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets.

Covert channel

A type of attack that subverts network security systems and policies to transfer data without authorization or detection.

Internet Relay Chat (IRC)

A group communications protocol that enables users to chat, send private messages, and share files.

Rootkit

Class of malware that modifies system files, often at the kernel level, to conceal its presence.

Ransomware

Malware that tries to extort money from the victim by blocking normal operation of a computer and/or encrypting the victim’s files and demanding payment.

Crypto-mining

Malware that hijacks computer resources to create cryptocurrency.

Logic bomb

A malicious program or script that is set to run under particular circumstances or in response to a defined event.

Exam

Objective

CompTIA Security+ SY0-701

2.4 Given a scenario, analyze indicators of malicious activity.

• Malware attacks

o   Ransomware

o   Trojan

o   Worm

o   Spyware

o   Bloatware

o   Virus

o   Keylogger

o   Logic bomb

o   Rootkit

TestOut Security Pro

3.1 Harden computer systems

3.1.2 Configure anti-virus protection

Video/Demo

Time

    2.3.1 Malware

6:02

    2.3.4 Implementing Malware Protections

6:27

    2.3.5 Use Windows Security

4:03

Total Video Time

16:32

Term

Definition

Cryptography

The science and practice of altering data to make it unintelligible to unauthorized parties.

Plaintext

Unencrypted data that is meant to be encrypted before it is transmitted, or the result of the decryption of encrypted data.

Ciphertext

Data that has been enciphered and cannot be read without the cipher key.

Algorithm

Operations that transform a plaintext into a ciphertext with cryptographic properties; also called a cipher.

Cryptanalysis

The science, art, and practice of breaking codes and ciphers.

Encryption

Scrambling the characters used in a message so that the message can be seen but not understood or modified unless it can be deciphered. Encryption provides for a secure means of transmitting data and authenticating users. It is also used to store data securely. Encryption uses different types of cipher and one or more keys. The size of the key is one factor in determining the strength of the encryption product.

Key

In cryptography, a specific piece of information that is used in conjunction with an algorithm to perform encryption and decryption.

Symmetric encryption

Two-way encryption scheme in which encryption and decryption are both performed by the same key. Also known as shared-key encryption.

Key length

Size of a cryptographic key in bits. Longer keys generally offer better security, but key lengths for different ciphers are not directly comparable.

Asymmetric algorithm

Cipher that uses public and private keys. The keys are mathematically linked, using either Rivel, Shamir, Adleman (RSA) or elliptic curve cryptography (ECC) alogrithms, but the private key is not derivable from the public one. An asymmetric key cannot reverse the operation it performs, so the public key cannot decrypt what it has encrypted, for example.

Public key

During asymmetric encryption, this key is freely distributed and can be used to perform the reverse encryption or decryption operation of the linked private key in the pair.

Private key

In asymmetric encryption, the private key is known only to the holder and is linked to, but not derivable from, a public key distributed to those with whom the holder wants to communicate securely. A private key can be used to encrypt data that can be decrypted by the linked public key or vice versa.

Blockchain

A concept in which an expanding list of transactional records listed in a public ledger is secured using cryptography.

Open public ledger

Distributed public record of transactions that underpins the integrity of blockchains.

Steganography

The practice of concealing a file, message, image, or video within another file, message, image, or video.

Exam

Objective

CompTIA Security+ SY0-701

4.2 Implement Encryption Technologies

4.2.1 Encrypt data communications

TestOut Security Pro

1.4 Explain the importance of using appropriate cryptographic solutions

• Public key infrastructure (PKI)

o   Public key

o   Private key

o   Key escrow

• Encryption

o   Asymmetric

o   Symmetric

o   Algorithms

o   Key length

• Obfuscation

o   Steganography

• Hashing
• Salting
• Digital signatures
• Blockchain

 
2.4 Given a scenario, analyze indicators of malicious activity

• Cryptographic attacks

o   Downgrade

o   Collision

o   Birthday

Video/Demo

Time

    3.1.1 Cryptography Concepts

7:00

    3.1.3 Symmetric vs Asymmetric Encryption

9:40

    3.1.4 Symmetric and Asymmetric Encryption Facts

5:53

    3.1.5 Cryptography Algorithm

9:18

    3.1.8 Blockchain

3:32

    3.1.10 Use Steganography to Hide a File

3:17

    3.1.12 Cryptographic Attacks

4:20

Total Video Time

43:00

Term

Definition

Obfuscation

A technique that essentially hides or camouflages code or other information so that it is harder to read by unauthorized users.

Steganography

A technique for obscuring the presence of a message, often by embedding information within a file or other entity.

Data masking

A de-identification method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data.

Tokenization

A de-identification method where a unique token is substituted for real data.

Key management system

In public key infrastructure (PKI), procedures and tools that centralizes generation and storage of cryptographic keys.

Trusted Platform Module (TPM)

Specification for secure hardware-based storage of encryption keys, hashed passwords, and other user- and platform-identification information.

Application programming interface (API)

Methods exposed by a script or program that allow other scripts or programs to use it. For example, an API enables software developers to access functions of the TCP/IP network stack under a particular operating system.

Secure enclave

CPU extensions that protect data stored in system memory so that an untrusted process cannot read it.

Exam

Objective

CompTIA Security+ SY0-701

1.4 Explain the importance of using appropriate cryptographic solutions.

• Encryption

o   Level

§  Full-disk

o   Asymmetric

o   Symmetric

o   Key exchange

• Tools

o   Trusted Platform Module (TPM)

o   Hardware security module (HSM)

o   Key management system

o   Secure enclave

• Obfuscation

o   Steganography

o   Hashing

• Digital signatures

TestOut Security Pro

4.0 Data Security
4.2 Implement Encryption Technologies

4.2.1 Encrypt data communications
4.2.2 Encrypt files

Video/Demo

Time

    3.2.1 Combining Cryptographic Methods

4:40

    3.2.2 Hardware-Based Encryption Devices

3:13

    3.2.3 Verify Device for TPM

2:56

Total Video Time

10:49

Term

Definition

Hashing algorithm

A function that converts an arbitrary-length string input to a fixed-length string output. A cryptographic hash function does this in a way that reduces the chance of collisions, where two different inputs produce the same output.

Cryptographic primitive

A single hash function, symmetric cipher, or asymmetric cipher.

Digital signature

A message digest encrypted using the sender's private key that is appended to a message to authenticate the sender and prove message integrity.

Salt

A security countermeasure that mitigates the impact of precomputed hash table attacks by adding a random value to ("salting") each plaintext input.

Key stretching

A technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks.

Secure Hash Algorithm (SHA)

A cryptographic hashing algorithm created to address possible weaknesses in multi-domain authentication (MDA). The current version is SHA-2.

Message-Digest Algorithm 5 (MD5)

A cryptographic hash function producing a 128-bit output.

Exam

Objective

CompTIA Security+ SY0-701

1.4 Explain the importance of using appropriate cryptographic solutions.

• Encryption

o   Algorithms

• Hashing
• Salting
• Digital signatures

TestOut Security Pro

4.0 Data Security
4.2 Implement Encryption Technologies

4.2.1 Encrypt data communications
4.2.2 Encrypt files

Video/Demo

Time

    3.3.1 Hashing

5:31

    3.3.2 Hashing Algorithms

3:33

    3.3.4 Using Hashes

4:50

Total Video Time

13:54

Term

Definition

Data at rest

Information that is primarily stored on specific media, rather than moving from one medium to another.

Data in transit (or data in motion)

Information that is being transmitted between two hosts, such as over a private network or the internet.

Data in use (or data in processing)

Information that is present in the volatile memory of a host, such as system memory or cache.

Transport/communication encryption

Encryption scheme applied to data-in-motion, such as WPA, IPsec, or TLS.

Key exchange

Any method by which cryptographic keys are transferred among users, thus enabling the use of a cryptographic algorithm.

Hash-based Message Authentication Code (HMAC)

A method used to verify both the integrity and authenticity of a message by combining a cryptographic hash of the message with a secret key.

Full disk encryption (FDE)

Encryption of all data on a disk (including system files, temporary files, and the page file) that can be accomplished via a supported OS, third party software, or at the controller level by the disk device itself.

Self-encrypting drives (SED)

A disk drive where the controller can automatically encrypt data that is written to it.

Key Encryption Key (KEK)

In storage encryption, the private key that is used to encrypt the symmetric bulk media encryption key (MEK). This means that a user must authenticate to decrypt the MEK and access the media.

Opal Storage Specification

Standards for implementing device encryption on storage devices.

Exam

Objective

CompTIA Security+ SY0-701

1.4 Explain the importance of using appropriate cryptographic solutions.

• Encryption

o   Full-disk

o   Database

• Tools

o   Trusted Platform Module (TPM)

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

• Encryption

TestOut Security Pro

4.0 Data Security
4.2 Implement Encryption Technologies

4.2.1 Encrypt data communications
4.2.2 Encrypt files

Video/Demo

Time

    3.4.1 Encrypting File System

3:48

    3.4.2 Encrypt Files

7:53

    3.4.4 PGP and GPG

2:27

    3.4.5 Encrypting Files with GPG

3:24

    3.4.6 BitLocker and Database Encryption

5:29

    3.4.7 Configuring BitLocker

4:53

Total Video Time

27:54

Term

Definition

Public key infrastructure (PKI)

A framework of certificate authorities, digital certificates, software, services, and other cryptographic components deployed for the purpose of validating subject identities.

Third party CAs

In PKI, a public CA that issues certificates for multiple domains and is widely trusted as a root trust by operating systems and browsers.

Digital certificate

Identification and authentication information presented in the X.509 format and issued by a certificate authority (CA) as a guarantee that a key pair (as identified by the public key embedded in the certificate) is valid for a particular subject (user or host).

Public Key Cryptography Standards (PKCS)

A series of standards defining the use of certificate authorities and digital certificates.

Certificate signing request (CSR)

A Base64 ASCII file that a subject sends to a CA to get a certificate.

Common name (CN)

An X500 attribute expressing a host or username, also used as the subject identifier for a digital certificate.

Subject alternative name (SAN)

A field in a digital certificate allowing a host to be identified by multiple host names/subdomains.

Wildcard

In PKI, a digital certificate that will match multiple subdomains of a parent domain.

Certificate revocation list (CRL)

A list of certificates that were revoked before their expiration date.

Online Certificate Status Protocol (OCSP)

Allows clients to request the status of a digital certificate, to check whether it is revoked.

Root certificate

In PKI, a certificate authority that issues certificates to intermediate certificate authorities in a hierarchical structure.

Certificate chaining/Chain of trust

A method of validating a certificate by tracing each CA that signs the certificate up through the hierarchy to the root CA.

Self-signed certificate

A digital certificate that has been signed by the entity that issued it, rather than by a certificate authority.

Escrow

In key management, the storage of a backup key with a third party.

Exam

Objective

CompTIA Security+ SY0-701

1.4 Explain the importance of using appropriate cryptographic solutions.

• Public key infrastructure (PKI)

o   Public key

o   Private key

o   Key escrow

• Digital signatures
• Certificates

o   Certificate authorities

o   Certificate revocation lists (CRLs)

o   Online Certificate Status Protocol (OCSP)

o   Self-signed

o   Third-party

o   Root of trust

o    Certificate signing request (CSR) generation

o   Wildcard

4.1 Given a scenario, apply common security techniques to
computing resources.

• Application security

o   Input validation

o   Secure cookies

o   Static code analysis

o   Code signing

TestOut Security Pro

4.2 Implement Encryption Technologies

4.2.3 Manage Certificates

Video/Demo

Time

    3.5.1 Public Key Infrastructure

5:12

    3.5.3 Certificate Types

4:06

    3.5.5 Manage Certificates

11:23

    3.5.7 Certificate Concepts

7:36

Total Video Time

28:17

Term

Definition

CIA Triad

Three principles of security control and management - confidentiality, integrity, and accessibility. Also known as the information security triad.

Confidentiality

The fundamental security goal of keeping information and communications private and protecting them from unauthorized access.

Integrity

The fundamental security goal of keeping organizational information accurate, free of errors, and without unauthorized modifications.

Availability

The fundamental security goal of ensuring that computer systems operate continuously and that authorized persons can access data that they need.

Non-repudiation

The security goal of ensuring that the party that sent a transmission or created data remains associated with that data and cannot deny sending or creating that data.

National Institute of Standards and Technology (NIST)

Develops computer security standards used by US federal agencies and publishes cybersecurity best practice guides and research.

cybersecurity frameworks (CSF)

Standards, best practices, and guidelines for effective security risk management. Some frameworks are general in nature, while others are specific to industry or technology types.

security controls

A technology or procedure put in place to mitigate vulnerabilities and risk and to ensure the confidentiality, integrity, and availability (CIA) of information.

Gap analysis

An analysis that measures the difference between the current and desired states in order to help assess the scope of work included in a project.

identity and access management (IAM)

A security process that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets like networks, operating systems, and applications.

Identification

The process by which a user account (and its credentials) is issued to the correct person. Sometimes referred to as enrollment.

Authentication

A method of validating a particular entity's or individual's unique credentials.

Authorization

The process of determining what rights and privileges a particular entity has.

Accounting

Tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted.

authentication, authorization, and accounting (AAA)

A security concept where a centralized platform verifies subject identification, ensures the subject is assigned relevant permissions, and then logs these actions to create an audit trail.

control plane

In zero trust architecture, functions that define policy and determine access decisions.

permissions

Security settings that control access to objects including file system items and network resources.

Discretionary access control (DAC)

An access control model where each resource is protected by an access control list (ACL) managed by the resource's owner (or owners).

Mandatory access control (MAC)

An access control model where resources are protected by inflexible, system-defined rules. Resources (objects) and users (subjects) are allocated a clearance level (or label).

Role-based access control (RBAC)

An access control model where resources are protected by ACLs that are managed by administrators and that provide user permissions based on job functions.

group account

A group account is a collection of user accounts that is useful when establishing file permissions and user rights because when many individuals need the same level of access, a group could be established containing all the relevant users.

Attribute-based access control (ABAC)

An access control technique that evaluates a set of attributes that each subject possesses to determine if access should be granted.

Rule-based access control

A nondiscretionary access control technique that is based on a set of operational rules or restrictions to enforce a least privileges permissions policy.

Least privilege

A basic principle of security stating that something should be allocated the minimum necessary rights, privileges, or information to perform its role.

Provisioning

The process of deploying an account, host, or application to a target production environment. This involves proving the identity or integrity of the resource, and issuing it with credentials and access permissions.

Deprovisioning

The process of removing an account, host, or application from the production environment. This requires revoking any privileged access that had been assigned to the object.

security identifier (SID)

The value assigned to an account by Windows and that is used by the operating system to identify that account.

group policy objects (GPOs)

On a Windows domain, a way to deploy per-user and per-computer settings such as password policy, account restrictions, firewall status, and so on.

geolocation

The identification or estimation of the physical location of an object, such as a radar source, mobile phone, or Internet-connected computing device.

time-of-day restrictions policy

Policies or configuration settings that limit a user's access to resources.

Exam

Objective

CompTIA Security+ SYO-701

1.2 Summarize fundamental security concepts.

• Confidentiality, Integrity, and Availability (CIA)
• Non-repudiation
• Authentication, Authorization, and Accounting (AAA)

o   Authenticating people

o   Authenticating systems

o   Authorization models

• Gap analysis
• Zero trust

o   Control plane

§  Adaptive identity

§  Threat scope reduction

§  Policy-driven access control

§  Policy Administrator

§  Policy Engine

o   Data plane

§  Implicit trust zones

§  Subject/System

§  Policy enforcement point

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

• Access control
• Least privilege

4.6 Given a scenario, implement and maintain identity and access management.

• Provisioning/de-provisioning user accounts
• Permission assignments and implications
• Identity proofing
• Access controls

o   Mandatory

o   Discretionary

o   Role-based

o   Rule-based

o   Attribute-based

o   Time-of-day restrictions

o   Least privilege

• Multifactor authentication

o   Implementations

§  Hard/soft authentication tokens

o   Factors

§  Something you know

§  Something you have

§  Something you are

§  Somewhere you are

5.1 Summarize elements of effective security governance.

• Policies

o   Information security policies

Video/Demo

Time

    4.1.1 Fundamental Security Concepts

4:40

    4.1.3 Access Control Best Practices

4:16

    4.1.4 Access Control Models

5:06

Total Video Time

14:02

Multi-factor authentication (MFA)

An authentication scheme that requires the user to present at least two different factors as credentials; for example, something you know, something you have, something you are, something you do, and somewhere you are. Specifying two factors is known as 2FA.

Factors

In authentication design, different technologies for implementing authentication, such as knowledge, ownership/token, and biometric/inherence. These are characterized as something you know/have/are.

Personal identification number (PIN)

A number used in conjunction with authentication devices such as smart cards; as the PIN should be known only to the user, loss of the smart card should not represent a security risk.

Hard authentication token

Authentication token generated by a cryptoprocessor on a dedicated hardware device. As the token is never transmitted directly, this implements an ownership factor within a multi-factor authentication scheme.

Smart cards

A security device similar to a credit card that can store authentication information, such as a user's private key, on an embedded cryptoprocessor.

One-time password (OTP)

A password that is generated for use in one specific session and becomes invalid after the session ends.

Security key

Portable HSM with a computer interface, such as USB or NFC, used for multi-factor authentication.

Soft authentication token

OTP sent to a registered number or email account or generated by an authenticator app as a means of two-step verification when authenticating account access.

Passwordless

Multi-   factor authentication scheme that uses ownership and biometric factors, but not knowledge factors.

Attestation

Capability of an authenticator or other cryptographic module to prove that it is a root of trust and can provide reliable reporting to prove that a device or computer is a trustworthy platform.

NT LAN Manager (NTLM) authentication

A challenge-response authentication protocol created by Microsoft for use in its products.

Pluggable authentication module (PAM)

A framework for implementing authentication providers in Linux.

Directory service

A network service that stores identity information about all the objects in a particular network, including users, groups, servers, client computers, and printers.

Lightweight Directory Access Protocol (LDAP)

Protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information.

Distinguished name (DN)

A collection of attributes that define a unique identifier for any given resource within an X.500-like directory.

Single sign-on (SSO)

Authentication technology that enables a user to authenticate once and receive authorizations for multiple services.

Kerberos

A single sign-on authentication and authorization service that is based on a time-sensitive, ticket-granting system.

Key distribution center (KDC)

A component of Kerberos that authenticates users and issues tickets (tokens).

Ticket Granting Ticket (TGT)

In Kerberos, a token issued to an authenticated account to allow access to authorized application servers.

Federation

A process that provides a shared login capability across multiple systems and enterprises. It essentially connects the identity management services of multiple systems.

Identity provider (IdP)

In a federated network, the service that holds the user account and performs authentication.

Security Assertion Markup Language (SAML)

An XML-based data format used to exchange authentication information between a client and a service.

Simple Object Access Protocol (SOAP)

An XML-based web services protocol that is used to exchange messages.

Representational State Transfer (REST)

A standardized, stateless architectural style used by web applications for communication and integration.

Open Authorization (OAuth)

A standard for federated identity management, allowing resource servers or consumer sites to work with user accounts created and managed on a separate identity provider.

JavaScript Object Notation (JSON)

A file format that uses attribute-value pairs to define configurations in a structure that is easy for both humans and machines to read and consume.

Biometric authentication

An authentication mechanism that allows a user to perform a biometric scan to operate an entry or access system. Physical characteristics stored as a digital data template can be used to authenticate a user. Typical features used include facial pattern, iris, retina, fingerprint pattern, and signature recognition.

False Rejection Rate (FRR)

A biometric assessment metric that measures the number of valid subjects who are denied access.

False Acceptance Rate (FAR)

A biometric assessment metric that measures the number of unauthorized users who are mistakenly allowed access.

Crossover Error Rate (CER)

A biometric evaluation factor expressing the point at which FAR and FRR meet, with a low value indicating better performance.

CompTIA Security+ SY0-701

1.2 Summarize fundamental security concepts.

• Confidentiality, Integrity, and Availability (CIA)
• Non-repudiation
• Authentication, Authorization, and Accounting (AAA)

o   Authenticating people

o   Authenticating systems

o   Authorization models

• Gap analysis
• Zero trust

o   Control plane

§  Adaptive identity

§  Threat scope reduction

§  Policy-driven access control

§  Policy Administrator

§  Policy Engine

o   Data plane

§  Implicit trust zones

§  Subject/System

§  Policy enforcement point

2.5 Explain the purpose of mitigation techniques used to secure the enterprise.

• Access control
• Least privilege

4.6 Given a scenario, implement and maintain identity and access management.

• Provisioning/de-provisioning user accounts
• Permission assignments and implications
• Identity proofing
• Access controls

o   Mandatory

o   Discretionary

o   Role-based

o   Rule-based

o   Attribute-based

o   Time-of-day restrictions

o   Least privilege

• Multi-factor authentication

o   Implementations

§  Hard/soft authentication tokens

o   Factors

§  Something you know

§  Something you have

§  Something you are

§  Somewhere you are

5.1 Summarize elements of effective security governance.

• Policies

o   Information security policies

Video/Demo

Time

    4.2.1 Authentication

5:28

    4.2.3 Authentication Methods

5:03

    4.2.4 Authentication Methods Facts

4:52

    4.2.5 Biometrics and Authentication Technologies

4:17

    4.2.6 Use a Biometric Scanner

2:09

    4.2.7 Use Single Sign-on

4:35

Total Video Time

26:24

Video/Demo

Time

    4.3.1 Authorization

3:18

    4.3.2 Cumulative Access

2:59

    4.3.4 Examining the Access Token

7:47

Total Video Time

14:04

Video/Demo

Time

    4.4.1 Active Directory Introduction

8:17

    4.4.2 Joining a Domain

8:38

    4.4.3 Managing Active Directory Objects

9:18

    4.4.7 Group Policy

8:47

    4.4.8 Use Group Policy

6:04

Total Video Time

41:04

Video/Demo

Time

    4.5.1 Hardening Authentication

7:55

    4.5.2 Configure User Account Restrictions

4:22

    4.5.3 Configure Account Policies and UAC Settings

6:58

    4.5.4 Use Password Managers

4:42

    4.5.6 Hardening User Accounts

5:43

    4.5.11 Configure Smart Card Authentication

5:38

Total Video Time

35:18